# CVE-2017-1000367
We discovered a vulnerability in Sudo’s get_process_ttyname() for Linux:
this function opens “/proc/[pid]/stat” (man proc) and reads the device number of the tty from field 7 (tty_nr). Unfortunately, these fields are space-separated and field 2 (comm, the filename of the command) can
contain spaces (CVE-2017-1000367).
For example, if we execute Sudo through the symlink “./ 1 “, get_process_ttyname() calls sudo_ttyname_dev() to search for the non-existent tty device number “1” in the built-in search_devs[].
Next, sudo_ttyname_dev() calls the function sudo_ttyname_scan() to search for this non-existent tty device number “1” in a breadth-first traversal of “/dev”.
Last, we exploit this function during its traversal of the world-writable “/dev/shm”: through this vulnerability, a local user can pretend that his tty is any character device on the filesystem, and
after two race conditions, he can pretend that his tty is any file on the filesystem.
On an SELinux-enabled system, if a user is Sudoer for a command that does not grant him full root privileges, he can overwrite any file on the filesystem (including root-owned files) with his command’s output,
because relabel_tty() (in src/selinux.c) calls open(O_RDWR|O_NONBLOCK) on his tty and dup2()s it to the command’s stdin, stdout, and stderr. This allows any Sudoer user to obtain full root privileges.
# Red Hat Enterprise Linux 6 (sudo) | :white_check_mark: |
# Red Hat Enterprise Linux 7 (sudo) | :white_check_mark: |
# Red Hat Enterprise Linux Server (v. 5 ELS) (sudo) | :white_check_mark: |
# Oracle Enterprise Linux 6 | :white_check_mark: |
# Oracle Enterprise Linux 7 | :white_check_mark: |
# Oracle Enterprise Linux Server 5 | :white_check_mark: |
# CentOS Linux 6 (sudo) | :white_check_mark: |
# CentOS Linux 7 (sudo) | :white_check_mark: |
# Debian wheezy | :white_check_mark: |
# Debian jessie | :white_check_mark: |
# Debian stretch | :white_check_mark: |
# Debian sid | :white_check_mark: |
# Ubuntu 17.04 | :white_check_mark: |
# Ubuntu 16.10 | :white_check_mark: |
# Ubuntu 16.04 LTS | :white_check_mark: |
# Ubuntu 14.04 LTS | :white_check_mark: |
# SUSE Linux Enterprise Software Development Kit 12-SP2 | :white_check_mark: |
# SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 | :white_check_mark: |
# SUSE Linux Enterprise Server 12-SP2 | :white_check_mark: |
# SUSE Linux Enterprise Desktop 12-SP2 | :white_check_mark: |
# OpenSuse, Slackware, and Gentoo Linux | :white_check_mark: |
## How do I patch sudo on CentOS/RHEL/Scientific/Oracle Linux server? :white_check_mark: |
# Terminal:> sudo yum update
# How do I patch sudo on Fedora Linux server?
# Terminal:> sudo dnf update
# How do I patch sudo on Suse/OpenSUSE Linux server? :white_check_mark: |
# Terminal:> sudo zypper update
# How do I patch sudo on Arch Linux server? :white_check_mark: |
# Terminal:> sudo pacman -Syu
# How do I patch sudo on Alpine Linux server? :white_check_mark: |
# Terminal:> apk update && apk upgrade
# How do I patch sudo on Slackware Linux server? :white_check_mark: |
# upgradepkg sudo-1.8.20p1-i586-1_slack14.2.txz
# How do I patch sudo on Gentoo Linux server? :white_check_mark: |
# Terminal:> emerge --sync
# Terminal:> emerge --ask --oneshot --verbose ">=app-admin/sudo-1.8.20_p1"
[4.0K] /data/pocs/cc20c509704e85a8e85ddebf810bbdb4cf68ba00
├── [3.3K] README.md
└── [2.2K] sudopwn.c
0 directories, 2 files